Repository navigation
feat(profiles): one profile per Linear workspace - #74
Open
taylorg009 wants to merge 4 commits into
Open
taylorg009 wants to merge 4 commits into
taylorg009 wants to merge 4 commits into
Conversation
A Linear API key belongs to one workspace, so a project in a second workspace (talora-health) could never be read with the shared key. --profile <name> or LINEAR_PROFILE now keeps config, cache, queue and uploads under ~/.linear-cli/profiles/<name>/ and resolves the key from the profile config, then Keychain linear-api-key with account <name>. LINEAR_API_KEY / LINEAR_TEAM_ID are not read under a profile. With neither set, the cwd's agents project picks the profile through the same `agents projects view` call the project auto-scope already makes, now done once in main() and reused. setup --keychain keeps the key out of config.json. The projects/initiatives <name> shorthand now survives a leading --team or --profile. Version 0.32.0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A profile's key now lives under its own Keychain service (linear-api-key.<profile>, linear-team-id.<profile>) instead of an account under the shared one: find-generic-password without -a matches any account, so the default profile could pick up a profile's key. The default lookup is unchanged. Review fixes: the cwd `agents` lookup in main() is skipped for commands that never scope by project and when the default config has autoScope: false; a cwd project only auto-scopes when its profile is the active one; profile names use fullmatch so a trailing newline is refused; an invalid profile in a project YAML is ignored with a warning instead of failing every command; and a test runs `tasks --similar --json` under a profile against a local Linear to prove its key, config and cache are the ones used. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
--profile default and LINEAR_PROFILE=default select the default profile:
default paths, the default key chain, and no cwd auto-profile lookup, so
agents-cli can pin LINEAR_PROFILE=default for an unprofiled project and the
directory can never redirect it to another workspace. activate_profile
('default') rebinds nothing and creates no profiles/default directory, and
`profile: default` on an agents project reads as the default profile.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The cwd profile was skipped for queue, states, labels, users, agents and inbox, so in a directory bound to a profile `update --done` queued into profiles/<name>/queue while `queue drain` there read the default queue with the default key. Profile selection from `agents projects view` now applies to every command except setup; the project auto-scope half of that answer still only applies in tasks and create. autoScope: false in the default config remains the switch that turns the cwd lookup off entirely. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A Linear API key belongs to one workspace, so a project in a second workspace could never be read with the shared key. Profiles give each workspace its own config, cache, queue, uploads and Keychain key.
What
--profile <name>(global flag) orLINEAR_PROFILE; the flag wins. Names match^[a-z0-9][a-z0-9._-]{0,63}$.~/.linear-cli/profiles/<name>/. The legacy~/.agents/linear.jsonmigration only applies to the default profile.apiKey, then Keychainlinear-api-keywith account<name>.LINEAR_API_KEY/LINEAR_TEAM_IDare not read under a profile (they belong to the default workspace). Default profile is unchanged.setup --keychainstores the key in the Keychain (servicelinear-api-key, account<profile|default>) and keepsapiKeyout of config.json.agents projects view . --jsoncall the auto-scope already makes, now done once inmain()and reused.projects <name>/initiatives <name>shorthand now survives a leading--teamor--profile.Companion PRs
agents-cli (
linear.profileon project defs,link --profile) and agi-ext (the Project panel passesLINEAR_PROFILE).Tests
Ran 294 tests OK (skipped=4); 14 new tests inProfileTest(fakesecurityandagentson PATH, local GraphQL server for setup). Verified live: defaulttasks --cycle all --jsonunchanged;LINEAR_PROFILE=zz tasksexits 1 naminglinear --profile zz setup; a bad key with--keychainwrites neither config nor Keychain.🤖 Generated with Claude Code